Question 1

Match each term with its definition:
-?A block in the Linux file system that specifies and keep tracks of the disk geometry and available space and manages the file system.

Accepted Answer

A)  B*-tree
B)  data block
C)  logical block
D)  inodes
E)  Volume Control BlockF) Allocation BlockG) header nodeH) data forkI) superblockJ) resource fork I

Question 2

Adding the _____________ flag to the ​ls -l command has the effect of of showing all files beginning with the "." character in addition to other files.

Accepted Answer

A)  -s​
B)  ​-d
C)  -l
D)  -a D

Question 3

What are bad blocks, and how do you find them?​

Accepted Answer

Some forensics tools ignore inode 1 and fail to recover valuable data for cases. Someone trying to mislead an investigator can access the bad block inode, list good sectors in it, and then hide information in these supposedly "bad" sectors.
To ﬁnd bad blocks on your Linux computer, you can use the badblocks command, although you must log in as root to do so. Linux includes two other commands that supply bad block information: mke2fs and e2fsck. The badblocks command can destroy valuable data, but the mke2fs and e2fsck commands include safeguards that prevent them from overwriting important information.

Question 4

​________________ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.

Accepted Answer

A)  ​Blocks
B)  ​Clusters
C)  Inodes
D)  Plist files

Question 5

Select below the command that can be used to display bad block information on a Linux file system, but also has the capability to destroy valuable information.​

Accepted Answer

A)  ​dd
B)  ​fdisk
C)  badblocks
D)  mke2fs

Question 6

After making an acquisition on a Mac computer, the next step is examining the image of the ﬁle system with a forensics tool. ​Explain how to select the proper forensics tool for the task.

Accepted Answer

The answer of After making an acquisition on a Mac...

Question 7

UNIX and Linux ​have four components defining the file system. Identify and give a brief description of each.

Accepted Answer

The answer of UNIX and Linux ​have four components defining...

Question 8

Capitalization, or lack thereof, makes no difference with UNIX and Linux commands.​

Accepted Answer

A) True 
 B)False

Question 9

Explain the differences between a hard link and a symbolic link.​

Accepted Answer

The answer of Explain the differences between a hard link...

Question 10

Match each term with its definition:
-?A key part of the Linux file system, these informatuin nodes contain descriptive file or directory data, such as UIDS, GIDs, modification times, access times, creation times, and file locations.

Accepted Answer

A)  B*-tree
B)  data block
C)  logical block
D)  inodes
E)  Volume Control BlockF) Allocation BlockG) header nodeH) data forkI) superblockJ) resource fork

Question 11

A hash that begins with "$6" in the shadow file indicates that it is a hash from what hashing algorithm? ​

Accepted Answer

A)  ​MD5
B)  ​Blowfish
C)  SHA-1
D)  SHA-512

Question 12

Match each term with its definition:
-?A node that stores information about B*-tree file.

Accepted Answer

A)  B*-tree
B)  data block
C)  logical block
D)  inodes
E)  Volume Control BlockF) Allocation BlockG) header nodeH) data forkI) superblockJ) resource fork

Question 13

Where is the root user's home directory located on a Mac OS X file system?​

Accepted Answer

A)  ​​/ root
B)  ​​/ private​/ var​/ root
C)  ​/ private​/ spool​/ root
D)  ​/ home​/ root

Question 14

Linux is a certified UNIX operating system.​

Accepted Answer

A) True 
 B)False

Question 15

Within the ​/ etc​/ shadow file, what field contains the password hash for a user account if one exists?​

Accepted Answer

A)  ​1st field
B)  ​2nd field
C)  3rd field
D)  4th field

Question 16

In UNIX and Linux, everything except monitors are considered files.​

Accepted Answer

A) True 
 B)False

Question 17

________ links are simply pointers to other files and aren't included in the link count.​

Accepted Answer

The answer of ________ links are simply pointers to other...

Question 18

Explain why one should have Apple factory training before attempting an acquisition on a Mac computer.​

Accepted Answer

The answer of Explain why one should have Apple factory...

Question 19

________________ is a specialized carving tool that can read many image file formats, such as RAW and Expert Witness.​

Accepted Answer

A)  ​AccessData FTK
B)  ​X-Ways Forensics
C)  Guidance Software EnCase
D)  Foremost

Question 20

​On Mac OS X systems, what utility can be used to encrypt ​/ decrypt a user's home directory?

Accepted Answer

A)  ​Disk Utility
B)  ​BitLocker
C)  FileVault
D)  iCrypt

Exam 7: Macintosh and Linux Boot Processes and File Systems

Match each term with its definition: -?A block in the Linux file system that specifies and keep tracks of the disk geometry and available space and manages the file system.

Adding the _____________ flag to the ls -l command has the effect of of showing all files beginning with the "." character in addition to other files.

What are bad blocks, and how do you find them?

________________ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.

Select below the command that can be used to display bad block information on a Linux file system, but also has the capability to destroy valuable information.

After making an acquisition on a Mac computer, the next step is examining the image of the ﬁle system with a forensics tool. Explain how to select the proper forensics tool for the task.

UNIX and Linux have four components defining the file system. Identify and give a brief description of each.

Capitalization, or lack thereof, makes no difference with UNIX and Linux commands.

Explain the differences between a hard link and a symbolic link.

Match each term with its definition: -?A key part of the Linux file system, these informatuin nodes contain descriptive file or directory data, such as UIDS, GIDs, modification times, access times, creation times, and file locations.

A hash that begins with "$6" in the shadow file indicates that it is a hash from what hashing algorithm?

Match each term with its definition: -?A node that stores information about B*-tree file.

Where is the root user's home directory located on a Mac OS X file system?

Linux is a certified UNIX operating system.

Within the / etc/ shadow file, what field contains the password hash for a user account if one exists?

In UNIX and Linux, everything except monitors are considered files.

________ links are simply pointers to other files and aren't included in the link count.

Explain why one should have Apple factory training before attempting an acquisition on a Mac computer.

________________ is a specialized carving tool that can read many image file formats, such as RAW and Expert Witness.

On Mac OS X systems, what utility can be used to encrypt / decrypt a user's home directory?

Exam 7: Macintosh and Linux Boot Processes and File Systems

Match each term with its definition: -?A block in the Linux file system that specifies and keep tracks of the disk geometry and available space and manages the file system.

Adding the _____________ flag to the ​ls -l command has the effect of of showing all files beginning with the "." character in addition to other files.

What are bad blocks, and how do you find them?​

​________________ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.

Select below the command that can be used to display bad block information on a Linux file system, but also has the capability to destroy valuable information.​

After making an acquisition on a Mac computer, the next step is examining the image of the ﬁle system with a forensics tool. ​Explain how to select the proper forensics tool for the task.

UNIX and Linux ​have four components defining the file system. Identify and give a brief description of each.

Capitalization, or lack thereof, makes no difference with UNIX and Linux commands.​

Explain the differences between a hard link and a symbolic link.​

Match each term with its definition: -?A key part of the Linux file system, these informatuin nodes contain descriptive file or directory data, such as UIDS, GIDs, modification times, access times, creation times, and file locations.

A hash that begins with "$6" in the shadow file indicates that it is a hash from what hashing algorithm? ​

Match each term with its definition: -?A node that stores information about B*-tree file.

Where is the root user's home directory located on a Mac OS X file system?​

Linux is a certified UNIX operating system.​

Within the ​/ etc​/ shadow file, what field contains the password hash for a user account if one exists?​

In UNIX and Linux, everything except monitors are considered files.​

________ links are simply pointers to other files and aren't included in the link count.​

Explain why one should have Apple factory training before attempting an acquisition on a Mac computer.​

________________ is a specialized carving tool that can read many image file formats, such as RAW and Expert Witness.​

​On Mac OS X systems, what utility can be used to encrypt ​/ decrypt a user's home directory?

Adding the _____________ flag to the ls -l command has the effect of of showing all files beginning with the "." character in addition to other files.

What are bad blocks, and how do you find them?

________________ contain file and directory metadata and provide a mechanism for linking data stored in data blocks.

Select below the command that can be used to display bad block information on a Linux file system, but also has the capability to destroy valuable information.

After making an acquisition on a Mac computer, the next step is examining the image of the ﬁle system with a forensics tool. Explain how to select the proper forensics tool for the task.

UNIX and Linux have four components defining the file system. Identify and give a brief description of each.

Capitalization, or lack thereof, makes no difference with UNIX and Linux commands.

Explain the differences between a hard link and a symbolic link.

A hash that begins with "$6" in the shadow file indicates that it is a hash from what hashing algorithm?

Where is the root user's home directory located on a Mac OS X file system?

Linux is a certified UNIX operating system.

Within the / etc/ shadow file, what field contains the password hash for a user account if one exists?

In UNIX and Linux, everything except monitors are considered files.

________ links are simply pointers to other files and aren't included in the link count.

Explain why one should have Apple factory training before attempting an acquisition on a Mac computer.

________________ is a specialized carving tool that can read many image file formats, such as RAW and Expert Witness.

On Mac OS X systems, what utility can be used to encrypt / decrypt a user's home directory?